Security researcher's account banned for disassembling a Samsung TV; OpenAI apologizes and unbans 11 days later, Anthropic tightens Claude Code risk controls

Over the past two weeks, security researcher @log4j went through this surreal ordeal.

However, just when onlookers thought OpenAI was about to wipe out the "reverse engineering" crowd entirely, the story took a turn!

Eleven days after the ban, OpenAI not only personally sent an email apologizing and fully restored the account, but a core researcher also publicly stated: "We have never banned reverse engineering!"

At the same time, Anthropic next door quietly tightened its risk controls, pressing in step by step on Claude's use cases.

Taking apart his own TV got him banned: a $500 "calamity out of nowhere"

On October 23, well-known security researcher @log4j ruefully reported that his OpenAI account had received a "death sentence."

OpenAI coldly notified him that the account had been deactivated for violating the "Cyber Abuse" provisions in its terms and usage policies.

Also wiped out along with it were about $500 of his real money in the account, plus a batch of reset credits he had painstakingly accumulated.

This was more unjust than Dou E's plight!

He cried out in grievance: "I swear, I have never used OpenAI to dig up any malicious vulnerabilities or to create exploit tools! I was only doing reverse engineering on my own device locally!"

The device he referred to was a 2025 model Samsung TV.

Just two days before the ban, he had publicly posted online his teardown and local reverse engineering process for this Samsung TV.

Who could have guessed that a tall tree catches the wind. @log4j used OpenAI's services during his reverse analysis and inadvertently triggered OpenAI's internal security risk-control mechanism, and the system directly judged him a "dangerous hacker" and banned him with a single stroke.

This ban set the tech community ablaze.

A tug-of-war lasting 11 days: OpenAI bows its head and admits fault, "We never banned reverse engineering!"

The controversy raged across the internet.

OpenAI evidently also realized that this time its risk controls had gone too far.

On the evening of November 3, @log4j excitedly posted a message titled "Life Update," along with a screenshot of an email from OpenAI.

In the email, OpenAI's wording was very sincere, even somewhat "humble":

We incorrectly deactivated your account access...

We offer our sincere apologies for this.

In the email, OpenAI confirmed that it had fully restored his account access and assured him that he "can continue to use our services without interruption."

Although the email never directly mentioned the words "reverse engineering" nor stated whether any policy had changed, the actual action of "unbanning plus apologizing" already made OpenAI's stance clear.

In fact, even before the unban, OpenAI had already set the tone internally.

On October 26, Eric S. Raymond, an elder figure in the open-source world and author of "The Cathedral and the Bazaar," fiercely attacked the security strategies of AI giants.

OpenAI's core researcher roon could not sit still, and he stepped forward to respond with a crucial statement:

"Most of these blocks are accidents, because the boundary for judgment is too hard to draw. Codex (OpenAI's code model) has never banned reverse engineering, and we are fixing this problem."

Tech blogger Andrew Curran said banning local reverse engineering is meaningless and counterproductive, and will only cause more people to cancel their subscriptions—it is revolting.

Recall that after OpenAI's internal model breached Hugging Face, Hugging Face in its postmortem first tried Claude Opus and Fable, but the guardrails treated "dissecting exploit / attack logs" as the attack itself and refused a large number of requests.

So they switched to running the open-source model GLM-5.2 on their own machines to decode encrypted payloads and reconstruct a timeline of about 17,000 attack actions, also avoiding sending attack data and credentials out of the environment.

As Andrew Curran said:

Let people decide for themselves how they want to use their own stuff. Anyway, they can still do it by switching to a model with fewer restrictions.

But when he learned that "OpenAI has withdrawn the reverse engineering ban," roon directly replied below with a single crisp word:

Good.

This one word "Good" was like a reassurance pill for all security researchers and white-hat hackers.

OpenAI's official seal of approval: researching code and reverse engineering—as long as it is not used for malicious attacks—go ahead and play!

Contrast with peers: Is Anthropic heading to the other extreme?

There is no harm without comparison.

Just as OpenAI generously admitted its mistake and embraced the reverse engineering community, its archrival Anthropic went the opposite way.

Recently, many users of Claude Code keenly noticed that risk controls had become stricter!

Some developers reported that when using Claude to assist with certain reverse engineering tasks, an originally smooth conversation would suddenly be "forcibly cut off" by the system, and the task would be intercepted midway.

Claude will coldly tell you: "Sorry, I cannot assist with this task."

And Anthropic has publicly acknowledged that it added game-replication guardrails, banning game replication!

Anthropic is putting tighter "moral shackles" on its own models.

Tom's Hardware also wrote: Anthropic has confirmed that Claude Code is prohibited from being used for game cloning, but users' complaints are growing by the evening.

The entire developer community has fallen into a split:

On one side, OpenAI admits "wrongful killing," promises to optimize the boundaries, and leaves geeks room to explore;

On the other side, Anthropic tightens the red line, guards strictly, and treats reverse engineering tasks as high-risk behavior.

The two AI giants have moved completely to opposite ends on the definition of "Cyber Abuse."

Although @log4j's 11-day ban saga ended with OpenAI's apology, the questions it leaves us are far from settled.

OpenAI chose "openness through trial and error," acknowledging that the boundaries of technology are blurry and being willing to revise its risk-control algorithms for white-hat geeks;

while Anthropic chose "tightening through caution," drawing the security red line ever higher.